Reject unsafe session JSON and validate native effect preparation

[tamashi095]

Malformed session JSON containing an empty object could abort native hosts or trap Wasm boot. The CLI could also report PASS for effect parameters that the engine refused during preparation.

Reject empty objects in lexical preflight with accurate diagnostics, preserving legal arrays and strings. Add native-effect preparation as the validator’s fifth stage, using the existing launch registry and typed diagnostics; canonical output is emitted only after success. Schema-only fixture bytes remain unchanged.

Independent Astra XHIGH verification passed native/parser/Wasm before-after controls, strict Clippy, 13,404,077 seeded parser fuzz executions in 901 seconds, ratio-boundary and CLI controls. The new shipped artifact reproduced its pin and passed existing resource, SDK/package and Chromium/Firefox/WebKit gates. Initial fuzz setup failure and first validator Clippy failure remain recorded in the issue specs.

Refs #387 and #211. Closure follows required PR and post-main qualification. Preserved PR #390 is superseded by this current-main delivery; its historical artifact pins and workflow changes are not carried forward. No claim that this fixes every nightly failure or certifies all host resources.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}